Skip to content
This repository was archived by the owner on Aug 29, 2026. It is now read-only.

Commit bf40da4

Browse files
scidominoDioNanos
scidomino
authored and
DioNanos
committed
security: update dependencies to fix critical and high vulnerabilities (google-gemini#27077)
1 parent 30668ab commit bf40da4

7 files changed

Lines changed: 338 additions & 303 deletions

File tree

‎package-lock.json‎

Lines changed: 245 additions & 277 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/a2a-server/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
],
2727
"dependencies": {
2828
"@a2a-js/sdk": "0.3.11",
29-
"@google-cloud/storage": "^7.16.0",
29+
"@google-cloud/storage": "^7.19.0",
3030
"@google/gemini-cli-core": "file:../core",
3131
"express": "^5.1.0",
3232
"fs-extra": "^11.3.0",

‎packages/core/package.json‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -33,22 +33,22 @@
3333
"@iarna/toml": "^2.2.5",
3434
"@modelcontextprotocol/sdk": "^1.23.0",
3535
"@opentelemetry/api": "^1.9.0",
36-
"@opentelemetry/api-logs": "^0.211.0",
37-
"@opentelemetry/core": "^2.5.0",
38-
"@opentelemetry/exporter-logs-otlp-grpc": "^0.211.0",
39-
"@opentelemetry/exporter-logs-otlp-http": "^0.211.0",
40-
"@opentelemetry/exporter-metrics-otlp-grpc": "^0.211.0",
41-
"@opentelemetry/exporter-metrics-otlp-http": "^0.211.0",
42-
"@opentelemetry/exporter-trace-otlp-grpc": "^0.211.0",
43-
"@opentelemetry/exporter-trace-otlp-http": "^0.211.0",
44-
"@opentelemetry/instrumentation-http": "^0.211.0",
45-
"@opentelemetry/otlp-exporter-base": "^0.211.0",
46-
"@opentelemetry/resources": "^2.5.0",
47-
"@opentelemetry/sdk-logs": "^0.211.0",
48-
"@opentelemetry/sdk-metrics": "^2.5.0",
49-
"@opentelemetry/sdk-node": "^0.211.0",
50-
"@opentelemetry/sdk-trace-base": "^2.5.0",
51-
"@opentelemetry/sdk-trace-node": "^2.5.0",
36+
"@opentelemetry/api-logs": "^0.218.0",
37+
"@opentelemetry/core": "^2.7.1",
38+
"@opentelemetry/exporter-logs-otlp-grpc": "^0.218.0",
39+
"@opentelemetry/exporter-logs-otlp-http": "^0.218.0",
40+
"@opentelemetry/exporter-metrics-otlp-grpc": "^0.218.0",
41+
"@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
42+
"@opentelemetry/exporter-trace-otlp-grpc": "^0.218.0",
43+
"@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
44+
"@opentelemetry/instrumentation-http": "^0.218.0",
45+
"@opentelemetry/otlp-exporter-base": "^0.218.0",
46+
"@opentelemetry/resources": "^2.7.1",
47+
"@opentelemetry/sdk-logs": "^0.218.0",
48+
"@opentelemetry/sdk-metrics": "^2.7.1",
49+
"@opentelemetry/sdk-node": "^0.218.0",
50+
"@opentelemetry/sdk-trace-base": "^2.7.1",
51+
"@opentelemetry/sdk-trace-node": "^2.7.1",
5252
"@opentelemetry/semantic-conventions": "^1.39.0",
5353
"@types/html-to-text": "^9.0.4",
5454
"@xterm/headless": "5.5.0",

‎packages/core/src/telemetry/file-exporters.test.ts‎

Lines changed: 50 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
*/
66

77
import { describe, it, expect, vi, beforeEach } from 'vitest';
8+
import {
9+
AggregationTemporality,
10+
type ResourceMetrics,
11+
} from '@opentelemetry/sdk-metrics';
812
import {
913
FileSpanExporter,
1014
FileLogExporter,
@@ -13,19 +17,17 @@ import {
1317
import { ExportResultCode } from '@opentelemetry/core';
1418
import type { ReadableSpan } from '@opentelemetry/sdk-trace-base';
1519
import type { ReadableLogRecord } from '@opentelemetry/sdk-logs';
16-
import {
17-
AggregationTemporality,
18-
type ResourceMetrics,
19-
} from '@opentelemetry/sdk-metrics';
2020
import * as fs from 'node:fs';
2121

2222
function createMockWriteStream(): {
2323
write: ReturnType<typeof vi.fn>;
2424
end: ReturnType<typeof vi.fn>;
25+
writable: boolean;
2526
} {
2627
return {
2728
write: vi.fn((_data: string, cb: (err?: Error | null) => void) => cb()),
2829
end: vi.fn((cb: () => void) => cb()),
30+
writable: true,
2931
};
3032
}
3133

@@ -186,8 +188,51 @@ describe('FileMetricExporter', () => {
186188
);
187189
});
188190

189-
it('should resolve forceFlush', async () => {
191+
it('should resolve forceFlush after pending writes complete', async () => {
192+
let writeFinished = false;
193+
mockWriteStream.write.mockImplementation(
194+
(_data: string, cb: (err?: Error | null) => void) => {
195+
setTimeout(() => {
196+
writeFinished = true;
197+
cb();
198+
}, 50);
199+
return true;
200+
},
201+
);
202+
203+
const exporter = new FileMetricExporter('/tmp/test-metrics.log');
204+
205+
// Start an export
206+
const exportDone = new Promise<void>((resolve) => {
207+
exporter.export({ resource: { attributes: {} } } as ResourceMetrics, () =>
208+
resolve(),
209+
);
210+
});
211+
212+
const flushPromise = exporter.forceFlush();
213+
214+
expect(writeFinished).toBe(false);
215+
await flushPromise;
216+
expect(writeFinished).toBe(true);
217+
await exportDone;
218+
});
219+
220+
it('should handle write error in forceFlush', async () => {
221+
const writeError = new Error('flush failed');
222+
mockWriteStream.write.mockImplementation(
223+
(_data: string, cb: (err?: Error | null) => void) => cb(writeError),
224+
);
225+
226+
const exporter = new FileMetricExporter('/tmp/test-metrics.log');
227+
await expect(exporter.forceFlush()).rejects.toThrow('flush failed');
228+
});
229+
230+
it('should resolve forceFlush immediately if stream is not writable', async () => {
190231
const exporter = new FileMetricExporter('/tmp/test-metrics.log');
232+
// @ts-expect-error - accessing protected member for test
233+
exporter.writeStream.writable = false;
234+
191235
await expect(exporter.forceFlush()).resolves.toBeUndefined();
236+
expect(mockWriteStream.write).not.toHaveBeenCalled();
192237
});
193238
});

‎packages/core/src/telemetry/file-exporters.ts‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,27 @@ class FileExporter {
2929
return safeJsonStringify(data, 2) + '\n';
3030
}
3131

32+
/**
33+
* Ensures that all pending writes are flushed to the underlying stream.
34+
*/
35+
forceFlush(): Promise<void> {
36+
return new Promise((resolve, reject) => {
37+
if (!this.writeStream.writable) {
38+
resolve();
39+
return;
40+
}
41+
// write('') will be queued after all previous writes and its callback
42+
// will be called when it (and thus all previous writes) are flushed.
43+
this.writeStream.write('', (err) => {
44+
if (err) {
45+
reject(err);
46+
} else {
47+
resolve();
48+
}
49+
});
50+
});
51+
}
52+
3253
shutdown(): Promise<void> {
3354
return new Promise((resolve) => {
3455
this.writeStream.end(resolve);
@@ -86,8 +107,4 @@ export class FileMetricExporter
86107
getPreferredAggregationTemporality(): AggregationTemporality {
87108
return AggregationTemporality.CUMULATIVE;
88109
}
89-
90-
async forceFlush(): Promise<void> {
91-
return Promise.resolve();
92-
}
93110
}

‎packages/core/src/telemetry/gcp-exporters.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ export class GcpTraceExporter extends TraceExporter {
2929
resourceFilter: /^gcp\./,
3030
});
3131
}
32+
33+
async forceFlush(): Promise<void> {
34+
return Promise.resolve();
35+
}
3236
}
3337

3438
/**

‎packages/core/src/telemetry/loggers.test.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ vi.mock('systeminformation', () => ({
136136
describe('loggers', () => {
137137
const mockLogger = {
138138
emit: vi.fn(),
139+
enabled: vi.fn().mockReturnValue(true),
139140
};
140141
const mockUiEvent = {
141142
addEvent: vi.fn(),

0 commit comments

Comments
 (0)